Security audit
Security checks for vulnerabilities and agentic risk
This document-writing skill needs review because its troubleshooting can grant account access, interrupt the messaging service, and bypass proxy settings without clear owner approval.
Keep account pairing, gateway restarts, proxy changes, and shared settings under administrator control. Verify reconstructed staffing, equipment, weather, and work details against daily source records before using these logs as official documentation. Weather lookups send location and dates to the provider.
SKILL.mdPairing instructions approve untrusted accounts without owner authorization
An unwanted account can become an authorized gateway user and send subsequent messages to the agent. The exact capabilities available to that account depend on gateway configuration, which is not included in this project.
The skill instructs the agent to terminate gateway processes and relaunch the entire gateway with proxy variables removed. This can both disrupt service and route subsequent gateway traffic outside intended proxy-based privacy, inspection, or access controls, rather than limiting the change to one failed upload.
The troubleshooting instructions terminate all processes matching a gateway command and restart the gateway with a hard-coded default profile. A routine construction-log task can therefore interrupt unrelated sessions or replace an intentionally configured service without administrative authorization.
Section 7.5 instructs the agent to persistently change general and local speech-to-text settings without obtaining explicit authorization for application configuration changes. Chinese transcription is relevant to the workflow, but changing shared settings can degrade transcription for other users or tasks.
The skill extends document generation into approving messaging-account pairing, which changes who is authorized to interact with the agent. Its instruction to approve a new account when a code is relayed lacks an independent owner-verification step, potentially granting an unintended account access to agent capabilities.
The supplied command performs messaging-gateway diagnostics rather than construction-log generation. Although transmission diagnostics could support a broader document-delivery workflow, that capability and access to gateway logs are not established by the declared purpose. The command does not modify files or transmit the retrieved information.
The pairing workflow crosses an authorization boundary by approving a new WeChat account as part of a construction-log skill. A relayed pairing code identifies a pending request but does not independently demonstrate that the agent owner authorizes that account to receive access.
The instructions present pairing approval as routine setup without explaining that it grants an account authorization to interact with the agent. The underlying risk is not merely the missing warning: the workflow also omits an explicit, trusted authorization check before granting that access.
An attachment-delivery failure triggers instructions for broad process termination and gateway-wide proxy removal, actions substantially beyond generating or sending a document. If followed, these instructions can interrupt other agent activity and bypass required network routing controls without a separate authorization decision.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Open-Meteo (structured, recommended)
curl -s "https://api.open-meteo.com/v1/forecast?latitude=29.87&longitude=121.55&daily=temperature_2m_max%2Ctemperature_2m_min%2Cweathercode&start_date=YYYY-MM-DD&end_date=YYYY-MM-DD&timezone=Asia%2FShanghai"
Round temps to whole degrees. Map WMO code via references/wmo-weather-codes.md.
Format: 最高XX°C 最低XX°C 天气描述
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Use Open-Meteo API for Ningbo/Zhenhai area:
https://api.open-meteo.com/v1/forecast?latitude=29.87&longitude=121.55&daily=temperature_2m_max%2Ctemperature_2m_min%2Cweathercode%2Cprecipitation_sum&start_date=YYYY-MM-DD&end_date=YYYY-MM-DD&timezone=Asia%2FShanghai
Ningbo coordinates: 29.87°N, 121.55°E
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Weather data sources
- **wttr.in** (quick lookup): `curl -s "wttr.in/Ningbo?m&lang=zh&1"` — gives 4-part daily forecast in Chinese
- **Open-Meteo API** (structured data): `https://api.open-meteo.com/v1/forecast?latitude=29.87&longitude=121.55&daily=temperature_2m_max%2Ctemperature_2m_min%2Cweathercode&start_date=YYYY-MM-DD&end_date=YYYY-MM-DD&timezone=Asia%2FShanghai%60
## Typical weather format (June, Ningbo/Zhenhai)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.open-meteo.com/v1/forecast?latitude=29.87&longitude=121.55&daily=temperature_2m_max%2Ctemperature_2m_min%2Cweathercode&start_date=YYYY-MM-DD&end_date=YYYY-MM-DD&timezone=Asia%2FShanghai
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
If ambiguity remains after checking China time, ask for exact dates rather than generating logs for the wrong days.
### 7.3 Power outage / connection drop
User may say "刚刚断电了" mid-conversation. Pick up from session history — do NOT ask user to repeat. Pending content is in recent messages.
### 7.4 Typhoon / weather cell length
Keep weather cell short (`最高33°C 最低26°C 台风`). Put full suspension reason in Row 4/5.
Removing proxy environment variables can expose the gateway's direct network origin and bypass proxy-based monitoring or routing requirements. Although this may resolve a genuine connectivity issue, the skill neither establishes that direct routing is permitted nor requests informed approval for the change.
The workflow instructs the agent to query weather for the project's actual location and target date using Open-Meteo or another external API. Although it names the service, it does not warn users that project-location and date information will be transmitted to a third party.
The instructions require explicit historical staffing and machinery values and substitute interpolated weather for retrieved observations, partly to make backfilled documents resemble neighboring logs. Adjacent records cannot establish those daily facts, so this can introduce unsupported assertions into construction records used for audits or compliance; draft labeling and disclosure reduce, but do not eliminate, that integrity risk.
The workflow instructs the agent to query Open-Meteo with the project's latitude/longitude and historical log dates; lines 206–211 prescribe a similar forecast request. Although the endpoints are shown, the skill does not warn the user that project-location and date information will be disclosed to an external provider.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Open-Meteo serves recent dates from the forecast endpoint — pass a date range:
curl -s "https://api.open-meteo.com/v1/forecast?latitude=29.87&longitude=121.55%5C
&daily=temperature_2m_max,temperature_2m_min,weathercode\
&start_date=2026-09-10&end_date=2026-09-11&timezone=Asia/Shanghai"
The low-activity guidance supplies unsupported personnel counts and equipment quantities, contradicting the explicit prohibition on inventing these facts. Because the skill generates formal, traceable construction records, these defaults could be presented as actual site observations and compromise staffing, equipment, and safety documentation. The surrounding truthfulness requirements mitigate intent but do not resolve the conflicting operational instructions.
The manifest describes converting daily WeChat site summaries into formatted .docx construction logs. This file instead directs monthly schedule derivation, progress-target presentation, PDF chart editing and redaction, and ZIP delivery; line L05 explicitly distinguishes this planning workflow from construction logs. These are separate deliverables, not implementation details needed to generate the declared logs.